8.4 Troubleshooting Synchronization

Troubleshooting Synchronization

Quick Answer: Most sync failures resolve to a small set of causes: duplicate attribute conflicts, invalid attribute values, filtering mistakes, accidental deletes, and provisioning/quarantine states. Use duplicate attribute resiliency and the fix sync errors tasks in the Entra admin center to remediate conflicts, and use the Synchronization Service Manager (Connect Sync) or the provisioning logs (Cloud Sync) to diagnose object-level failures.

Duplicate Attribute Conflicts

The most common sync error is a duplicate attribute conflict — two on-prem objects claim the same value for an attribute that Entra ID requires to be unique, usually userPrincipalName or proxyAddresses.

Duplicate attribute resiliency is a Microsoft Entra ID feature that quarantines the conflicting attribute on the duplicate object instead of dropping the object. The first object keeps the value; the second object is provisioned with the conflicting value blanked or quarantined, and a sync error is raised. Resiliency prevents data loss but does not resolve the conflict — you must fix the source.

Resolution:

1. Identify the conflict from the Connect Health object-level error or the Cloud Sync provisioning log
2. Edit one of the two on-prem objects so it has a unique value
3. Run a delta sync (Connect Sync) or wait for the next Cloud Sync cycle
4. The sync engine retries the quarantined attribute and clears the error once the values are unique

Large-Object and Invalid-Attribute Errors

• Large-object errors (LargeObject) occur when an attribute exceeds the sync engine's limit — for example, a userCertificate or thumbnailPhoto larger than the allowed size. Fix by trimming the offending attribute on the source object.
• Invalid attribute values (InvalidAttribute) occur when a value fails validation — a malformed UPN, an unsupported character, or a value that violates the Entra schema. Fix the value in AD, then re-sync.

Filtering Mistakes

A common operational mistake is removing an OU from sync scope and expecting the previously synchronized objects to disappear from Entra ID. They do not — once an object has been synced, removing its container from scope stops updates but does not delete the cloud copy. The cloud object is now orphaned: it will not receive attribute updates, and the source-of-truth link is effectively broken.

Resolution options:

• Re-add the OU to scope and then properly deprovision the users (for example, by disabling and letting the next cycle flow the disable state)
• Manually delete the orphaned cloud objects in the Entra admin center if they should not exist
• Use the fix sync errors task in the Entra admin center, which can guide removal of orphaned objects

Restoring Accidentally Deleted Users: Soft-Match vs Hard-Match

When an on-prem user is accidentally deleted and recreated, or when a cloud-only user needs to be relinked to a new on-prem identity, you use matching to re-establish the link:

• Soft-match — the sync engine matches on mail or userPrincipalName. If a deleted on-prem user is recreated with the same UPN and mail, the sync engine soft-matches the new on-prem object to the existing cloud object and resumes updates.
• Hard-match — the sync engine matches on immutableId (the sourceAnchor). Use hard-match when the cloud object already exists and you have the original sourceAnchor value; set the sourceAnchor on the new on-prem object to the original and the engine hard-matches.

Soft-match is the easier path when the original anchor is unavailable; hard-match is the deterministic path when you can recover the anchor.

Provisioning and Quarantine States (Cloud Sync)

Cloud Sync places a configuration into quarantine after repeated errors. Common triggers:

• Invalid provisioning agent credentials
• A sustained burst of duplicate-attribute conflicts
• Loss of connectivity to the on-prem AD
• A bad scoping filter that produces no valid objects

While in quarantine, Cloud Sync pauses provisioning. Clearing quarantine requires fixing the root cause and then restarting provisioning on the configuration from the Entra admin center. The provisioning page shows the quarantine reason; the provisioning logs show the failing objects.

Diagnostic Surfaces

Troubleshooting Table

Using the Fix Sync Errors Tasks

The Entra admin center exposes fix sync errors tasks that operationalize the most common remediations:

• Duplicate attribute resiliency — surfaces quarantined attributes so you can review and release them once the source is fixed
• Orphaned object cleanup — helps identify cloud objects whose source link is broken
• Group-based filtering review — verifies that pilot scoping still includes the intended users

Use these tasks as a first stop before drilling into Connect Health or the provisioning logs — they often localize the problem in one click.